The work system for HVAC installers in Israel.

The permissions we request, and what each one is for

• https://www.googleapis.com/auth/calendar.events — permission to create, update and delete events in the calendar you selected. We use it to write your BTU appointments (installation jobs, maintenance visits and meetings) into Google Calendar, to update them when they change in BTU, and to delete them when they are deleted in BTU. We identify the events we created by a private marker we add to each one (extendedProperties.private.btuId), and we do not modify or delete events in your calendar that were not created by BTU.
• https://www.googleapis.com/auth/calendar.readonly — read access to the calendars in the account. We use it for two purposes only: (a) to show you the list of calendars, so that you can choose which one to sync with; (b) to read the changes you made in Google Calendar — a new time, title or location, or a deletion — and pull them back into BTU, so that the two schedules stay identical.

Both permissions are used solely for the calendar sync described on this page. We do not request scopes broader than this purpose requires.

What we store

• A Google refresh token and access token, and the access token expiry time — required so that the sync can run in the background without asking you to sign in again every time.
• The email address of the connected Google account, and the id and name of the selected calendar — so that we can show you what you are connected to and where events are going.
• For each synced event: its Google event id, its etag (the version stamp Google issues) and the time it was last synced. The etag prevents a sync loop — it stops us pulling back a change that we wrote ourselves.
• A syncToken — the token Google issues so that we can fetch only what changed since the previous sync, instead of reading the whole calendar every time.
• The content of an event that was created in Google Calendar and pulled into BTU: title, date, start time and duration, all-day flag, location, description and recurrence rule. That is what becomes an event in your BTU schedule, and it is stored like any other event in the system.

What we do not collect and do not store

• We never receive and never store your Google account password.
• Attendee lists, participant email addresses, RSVP responses, Google Meet links and event attachments are not read into the system and are not stored by us.
• Individual instances or exceptions of a recurring event are not imported; only the parent event is.
• On the first sync we read events from 30 days back onwards only. Your older calendar history is never scanned and never stored.
• The sync runs against the single calendar you selected. Other calendars in the account are neither read nor written, apart from their names appearing in the selection list.
• We have no access to Gmail, Google Drive, Google Contacts or any other Google service. The permissions we request are calendar permissions.

How the tokens are protected

Tokens are stored in a dedicated server-side table (gcal_accounts), separate from user settings, and are used only by the sync process running on the server. Tokens are never returned to the client (the browser) in any screen or any API response, are never displayed in the interface, and are not included in data exports. All traffic to Google is encrypted with TLS, database access is restricted and audited, and backups are stored encrypted.

Turning it off

• Disconnect from inside BTU — Settings → "Calendar, holidays and weather" → "Disconnect". This immediately deletes from our server the refresh token, the access token, the syncToken, the connected calendar details, and every link record between BTU events and Google events (event ids and etag values). The sync stops at once.
• Revoke access from your Google account — at any time, on the permissions page of your Google account: https://myaccount.google.com/permissions. Revoking invalidates the tokens we hold and the sync stops. We recommend clicking "Disconnect" in BTU as well, so that the remaining records are deleted on our side.
• What is deleted, and only if you ask — disconnecting on its own deletes no events: events already written into your Google Calendar stay there, and BTU events stay in BTU. The disconnect screen offers two separate deletions, neither of them ticked by default — deleting from Google Calendar the events BTU created there, and deleting from BTU the events imported from Google Calendar — and it shows the exact number of events on each side before you confirm. The deletion in Google Calendar touches only the events BTU created, and the deletion in BTU touches only the events imported from Google Calendar — events created in BTU stay where they are. If you disconnected in the past and imported events remained in BTU, they can be deleted from that same screen after the fact.
• Deleting your BTU account also deletes the calendar connection data.

A lighter alternative: a read-only ICS link

If you only want to see the BTU schedule inside Google Calendar, without connecting an account and without granting any write permission, you can subscribe to a read-only ICS feed instead. No OAuth connection is created in that case.

Limited Use

BTU's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Google Calendar data is used only to operate the sync for you. We do not sell it, and we do not share it with any third party (other than Google itself, which is the other side of the sync). We do not use it for advertising, profiling or marketing, and we do not use it — nor allow anyone else to use it — to train artificial intelligence models. Calendar data is not sent to the AI providers listed among our processors. Humans do not access calendar data, except where you have explicitly asked us to for support, where it is required for security or fault diagnosis, or where the law requires it.

The full detail is in section 3 of the privacy policy.